Anti-DDoS Proxy (Outside Chinese Mainland) offers the Global, Global Partner, and Outside Chinese Mainland protection plans. This topic describes the plan fees, the tiered pricing for clean bandwidth, and the billing of the legacy secure acceleration line plans.
New protection plans
Starting October 15, 2026, you can select the Global, Global Partner, or Outside Chinese Mainland protection plan when you purchase a new Anti-DDoS Proxy (Outside Chinese Mainland) instance.
Protection plan | Scenarios | Protection method | Available specifications |
Global | The origin server is outside the Chinese mainland, and you need to serve users in the Chinese mainland and overseas at the same time | A single instance IP provides cross-border acceleration and global overseas protection; attacks from different directions share the same mitigation sessions | 0, 1, 2, or unlimited full-capacity mitigation events per month; the 0-event tier provides best-effort traffic scrubbing only |
Global Partner | Businesses that purchase through channels and want to select a specification based on the cross-border Mitigation Threshold | Cross-border traffic is protected on a committed basis up to the selected threshold, and best-effort protection is provided overseas; free best-effort protection serves as a fallback after the threshold or the session allowance is exceeded | The 100–1,000 Gbit/s tiers include one overseas full-capacity mitigation event per month; the best-effort tier includes unlimited overseas full-capacity mitigation events. In the first phase, this plan is available only to eligible channel customers |
Outside Chinese Mainland | Both the origin server and the users are overseas, and cross-border acceleration to the Chinese mainland is not required | Carries over the previous Anti-DDoS Proxy (International) service model and provides Anycast access and full-capacity traffic scrubbing outside the Chinese mainland | Insurance: 2 mitigation events per month; Unlimited: no limit on mitigation events |
Plan pricing
The following table lists the reference monthly fees of the base plans. The specifications that you can actually purchase and the transaction prices are subject to the buy page.
Protection plan | Specification | Monthly fee |
Global | 0 / 1 / 2 / unlimited events | USD 1,600 / 8,000 / 16,000 / 40,000 |
Global Partner | 100–1,000 Gbit/s or best effort | USD 1,980–49,800 |
Outside Chinese Mainland | Insurance / Unlimited | USD 2,630 / 11,560 |
Tiered pricing for clean bandwidth
The clean bandwidth of the Global and Global Partner plans uses progressive tiered pricing.
Bandwidth tier | Subscription unit price |
0–100 Mbit/s | USD 160/Mbit/s/month |
>100–500 Mbit/s | USD 128/Mbit/s/month |
>500 Mbit/s | USD 92.8/Mbit/s/month |
Specification | Global / Global Partner | Outside Chinese Mainland |
clean bandwidth | Includes 10 Mbit/s of cross-border bandwidth and grants the same amount of overseas bandwidth at a 1:1 ratio; extended bandwidth uses the tiered pricing described above | The international line is billed according to the selected Insurance or Unlimited specification; prices are subject to the buy page |
Clean queries per second (QPS) | 500 QPS by default and can be extended; subscription QPS continues to use the existing pricing | 500 QPS by default and can be extended; subscription QPS continues to use the existing pricing |
Number of protected domain names / Number of ports | 10 domain names and 5 ports by default and can be extended | 10 domain names and 5 ports by default and can be extended |
Burstable pay-as-you-go billing | Global: daily 95th percentile burstable clean bandwidth and burstable QPS are enabled by default; Global Partner: disabled, and traffic is throttled or requests are rate-limited when the service specifications are exceeded | Daily 95th percentile burstable fees are charged at the unit price of each billing item |
Global Partner tier prices
Global Partner protection tier | Overseas full-capacity mitigation events | Monthly fee (USD) |
100 Gbit/s | One per month | 1,980 |
200 Gbit/s | One per month | 3,580 |
300 Gbit/s | One per month | 5,180 |
400 Gbit/s | One per month | 6,780 |
500 Gbit/s | One per month | 8,380 |
600 Gbit/s | One per month | 9,980 |
1,000 Gbit/s | One per month | 22,000 |
Best effort | Unlimited | 49,800 |
The prices above are for reference. The actual prices are subject to the quotes on the buy page. Full logs must still be purchased separately.
Both Global and Global Partner include 10 Mbps of clean bandwidth by default. Mitigation capabilities of Global Partner cover only the cross-border direction, and the overseas best-effort mitigation capability is provided as a number of mitigation events.
Legacy secure acceleration line plans
For services onboarded for protection, the secure acceleration line of Anti-DDoS Proxy (Outside Chinese Mainland) provides access acceleration and Key concepts capabilities. Different instance versions support different numbers of advanced mitigation sessions, and the corresponding base instance fees also differ.
Sec-CMA 2.0 does not support the purchase of advanced mitigation resource plans. If you need more advanced mitigation sessions, upgrade the instance version (for example, from “0 sessions” to “2 sessions” or “unlimited sessions”). For more information, see Instance management.
Sec-CMA 2.0 (existing instances only)
Sec-CMA 2.0 supports the China Telecom, China Unicom, and China Mobile lines in the Chinese mainland and provides more than 2 Tbps of traffic scrubbing capacity against DDoS attacks. Existing instances can continue to use their original mitigation session specifications.
Instance type | New purchases supported | Protected carrier lines | Advanced mitigation sessions | How to extend mitigation sessions |
Sec-CMA 2.0 | Existing instances only. No longer available for standard new purchases | China Telecom, China Unicom, and China Mobile in the Chinese mainland | Selectable: None, 1, 2, or Unlimited | Implemented by upgrading the instance version. Purchasing an advanced mitigation resource plan is not supported |
Legacy versions (not recommended for new purchases)
The following are legacy versions that are no longer recommended for new purchases. If you are currently using a legacy version, we recommend that you upgrade to Sec-CMA 2.0.
Instance type | New purchases supported | Protected carrier lines | Advanced mitigation sessions | Mitigation session purchase supported |
Sec-CMA 1.0 | New purchases are no longer supported. If you need this version, contact your pre-sales account manager. | China Telecom and China Unicom in the Chinese mainland | 2 per calendar month | Supported. Purchase an advanced mitigation resource plan. |
Sec-CMA 1.0 (Basic Edition) | New purchases are no longer supported. | China Telecom and China Unicom in the Chinese mainland | 1 per calendar month | Supported. Purchase an advanced mitigation resource plan. |
Sec-CMA 2.0 (Insurance) | Existing instances only. The features have been migrated to Sec-CMA 2.0. | China Telecom, China Unicom, and China Mobile in the Chinese mainland | 2 per calendar month | Not supported. You can upgrade to Sec-CMA 2.0. |
Sec-CMA 2.0 (Unlimited) | Existing instances only. | China Telecom, China Unicom, and China Mobile in the Chinese mainland | Unlimited | Not applicable. |
Billing of the legacy secure acceleration line
The following prices are for reference only. The actual transaction prices of all specifications are subject to the Anti-DDoS Proxy (Outside Chinese Mainland) buy page.
Total fee = subscription instance fee + pay-as-you-go fee
Subscription instance fees
Subscription instance fee = base instance fee + extended configuration item fee
Base instance fees
Pricing
Sec-CMA 2.0 (existing instances only)
Instance type | Unit price (USD/month) |
Sec-CMA 2.0 (existing instances only) | Fees are charged based on the configured number of mitigation sessions:0 sessions: 1,548; 1 session: 7,740; 2 sessions: 15,480; Unlimited: 36,843 |
Legacy versions (not recommended for new purchases)
Instance type | Unit price (USD/month) |
Sec-CMA 1.0 | 15,480 |
Sec-CMA 1.0 (Basic Edition) | 9,288 |
Sec-CMA 2.0 (Insurance) | 15,480 |
Sec-CMA 2.0 (Unlimited) | 36,843 |
Specifications
The configuration items covered by the base instance fee all use the default minimum specifications. The default specifications are the same for every instance, as listed in the following table. You can also extend the specification of a configuration item based on your business needs.
Specification | Secure acceleration line specifications | Billing mode | Description |
clean bandwidth | 10 Mbps | Upfront | The maximum service traffic that the instance can handle when no attack occurs. The specification can be extended. |
95th Percentile Burstable Clean Bandwidth mode | Daily 95th percentile mode | Pay-as-you-go | Pay-as-you-go fees are generated when the actual bandwidth is greater than the clean bandwidth and less than the 95th Percentile Burstable Clean Bandwidth. |
Clean queries per second (QPS) | 500 | Upfront | The maximum concurrent request rate for HTTP and HTTPS services that the instance can handle when no attack occurs. The specification can be extended. Set this parameter based on your actual service usage. If the actual service usage exceeds the Clean queries per second (QPS) specification that you selected at purchase, service requests are dropped and full log records become incomplete. |
95th percentile burstable QPS mode | Daily 95th percentile mode | Pay-as-you-go | Pay-as-you-go fees are generated when the actual QPS is greater than the clean QPS specification and less than the 95th percentile burstable QPS. |
function plan | Standard function plan | Upfront | Includes the Standard function plan and the Enhanced function plan. The Enhanced function plan builds on the Standard function plan to strengthen the service onboarding capability and the DDoS attack prevention capability of Anti-DDoS Proxy. For more information, see Descriptions of function plans. |
Number of protected domain names | 10 | Upfront | The number of HTTP and HTTPS domain names that the instance can add. The specification can be extended. Each additional 10 domain names allow one additional top-level domain name. |
Number of ports | 5 | Upfront | The number of TCP and UDP ports that the instance can add. The specification can be extended. |
Fees for extended configuration items
The secure acceleration line of Anti-DDoS Proxy (Outside Chinese Mainland) supports upgrading the following configurations on top of the base configuration.
clean bandwidth:Per 10 Mbps: USD 1,548/month
Clean queries per second (QPS)
Clean queries per second (QPS)
Unit price (USD/month/QPS)
0<QPS≤500
0
500<QPS≤5,000
1.5
5,000<QPS≤8,000
1.425
8,000<QPS≤10,000
1.35
10,000<QPS≤50,000
1.275
50,000<QPS≤100,000
1.05
function plan:Enhanced function plan: USD 1,200/month
Number of protected domain names
Number of domain names
Unit price for the Standard function plan (USD/month/domain name)
Unit price for the Enhanced function plan (USD/month/domain name)
0 < number of domain names ≤ 10
0
0
10 < number of domain names ≤ 500
4.5
7.5
500 < number of domain names ≤ 1,000
4.1
7
1,000 < number of domain names ≤ 5,000
3.7
6.5
5,000 < number of domain names ≤ 10,000
3.2
5.8
10,000 < number of domain names ≤ 20,000
2.7
4.5
Number of ports
Number of ports
Unit price (USD/month/port)
0 < number of ports ≤ 5
0
5 < number of ports ≤ 50
30
50 < number of ports ≤ 100
26
100 < number of ports ≤ 500
22
500 < number of ports ≤ 1,500
18
Pay-as-you-go
You can choose whether to enable each pay-as-you-go feature based on your business needs. After a feature is enabled, a pay-as-you-go bill is generated only when the billing conditions are met.
Feature | Billing method | Description |
95th Percentile Burstable Clean Bandwidth | Pay-as-you-go by day or by month | Burstable clean bandwidth elastically increases the clean bandwidth of an instance on top of its base clean bandwidth. It resolves throttling caused by fluctuations in normal service traffic during peak hours. For more information, see Burstable clean bandwidth billing. |
95th percentile burstable QPS | Pay-as-you-go by day or by month | Burstable QPS elastically increases the QPS of an instance on top of its base clean QPS. It resolves throttling caused by fluctuations in normal service QPS during peak hours. For more information, see Burstable QPS billing. |
Expiration
Period | Service traffic forwarding | Instance configuration |
Within 7 calendar days after expiration (exclusive) | The instance retains a 5 Gbps blackhole filtering threshold, and a blackhole is triggered when service forwarding and attack traffic exceed 5 Gbps. Access acceleration is no longer provided. | The instance configuration is retained. |
From the 7th calendar day (inclusive) to the 15th calendar day (exclusive) after expiration | Service traffic forwarding is stopped. If you no longer use the secure acceleration line, make sure that you switch service traffic from Anti-DDoS Proxy to your origin server at least 7 calendar days before the instance expires. | The instance configuration is retained. |
The 15th calendar day after expiration | Service traffic forwarding is stopped. | The instance is released. |
After the instance expires, promptly switch service traffic back to your origin server to avoid affecting service access.
Overdue payments
Your account is considered to have an overdue payment when its available balance, including cash, vouchers, and coupons, cannot settle issued bills.
After your account has an overdue payment, top up your account promptly to keep a sufficient balance and avoid service unavailability.
Renewal policy
Instances support manual renewal and auto-renewal. For instructions, see Renew an instance.
Refund policy
Refunds are not supported after purchase.
Bill query
You can query bills in Expenses and Costs. For more information, see Overview of Monthly Bill.